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Abstract 

Autonomous Flight Safety System (AFSS) is an independent flight safety system designed for 
small to medium sized expendable launch vehicles launching from or needing range safety protection 
while overlying relatively remote locations. AFSS replaces the need for a man-in-the-loop to make 
decisions for flight termination. AFSS could also serve as the prototype for an autonomous manned flight 
crew escape advisory system. 

AFSS utilizes onboard sensors and processors to emulate the human decision-making process 
using rule-based software logic and can dramatically reduce safety response time during critical launch 
phases. The Range Safety flight path nominal trajectory, its deviation allowances, limit zones and other 
flight safety rules are stored in the onboard computers. Position, velocity and attitude data obtained from 
onboard global positioning system (GPS) and inertial navigation system (INS) sensors are compared with 
these rules to determine the appropriate action to ensure that people and property are not jeopardized. 

The final system will be fully redundant and independent with multiple processors, sensors, and dead man 
switches to prevent inadvertent flight termination. 

AFSS is currently in Phase III which includes updated algorithms, integrated GPS/INS sensors, 
large scale simulation testing and initial aircraft flight testing. 

Introduction 

Public safety risk from hazards associated with the flight of expendable launch vehicles (ELV) is 
currently mitigated through the use of ground-commanded flight termination systems. During a typical 
mission, vehicle time-space-position-information (TSPI) from tracking radar and onboard navigation 
sensor telemetry data is collected at the launch site and remote downrange sites. The data is relayed via a 
communications network to flight safety decision makers located in a range control center. These 
personnel monitor the progress of the flight against a set of mission rules using a sophisticated network of 
ground-based data processors and range-graphics display systems. When necessary, onboard destruct 
charges are initiated by commands sent from the range control center to the active ground transmitters 
which relay the commands to the vehicle via radio frequency uplink. To ensure adequate command 
coverage for the duration of the ascent trajectory, multiple transmitters are used at geographically 
separated sites necessitating a reliable data communications network to coordinate switching between 
sites and for relaying commanded functions from a control center to the active transmitter site. 

Reducing the costs of this launch vehicle range infrastructure and expanding the areas where 
launches may occur is a continuing effort to broaden space access markets. One element of the cost 
reduction strategy focuses upon elimination of the vehicle tracking radar by utilizing an existing space- 
based launch vehicle tracking network — Global Positioning Satellites (GPS). This paper describes a 
NASA proof-of-concept project that seeks to exploit the advantages of a non-traditional range safety 
system by Utilizing this technique to allow the launch vehicle to “know” its own position very precisely. 
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Figure 1. Possible Future Range Safety Concept 




NASA’s Range Systems Design and Development Branch at Kennedy Space Center (KSC) and 
Guidance, Navigation, and Control Systems Engineering Branch at Wallops Flight Facility (WFF), are 
currently designing and building a prototype AFSS which is intended to be a real-time onboard hardware 
and software system for tracking and possible flight termination. AFSS is being designed primarily for 
small expendable vehicles at remote launch sites where traditional ground-based range safety 
infrastructure, including RF communication and command links, radar stations, data processing, display 
facilities, and trained operators would be extremely expensive. Advantages of AFSS include global 
coverage and decreased costs during remote launch site operations. The system may also be useful as a 
training aid and as a backup system for other types of vehicles. GPS receivers in conjunction with Inertial 
Navigational Systems (INS) provide tracking data. Onboard processors compare the current position, 
velocity, and attitude with the nominal trajectory and predetermined flight safety rules in order to 
autonomously implement flight termination when appropriate (see Figure 1). A feasibility study (Phase I) 
was completed in 2000, and an initial proof-of-concept hardware system (Phase II) was successfully 
tested in 2002. NASA is currently in Phase III of AFSS development, which is a 3 year effort to produce 
a flight qualifiable system. 

Phase I Development (Historical) 

Phase I of AFSS was a Research and Design Feasibility Demonstration performed by Lockheed 
Martin Space Systems Company under contract NAS 1 0-9905 1 . This was awarded to them in response to 
Amendment 4, NASA Research Announcement 8-21 and was managed by KSC personnel. During this 
phase of the project, the technical feasibility of performing a range function autonomously was verified. 
Phases of the rocket’s liftoff and ascent were defined as shown in Figure 2. 



Figure 2. Liftoff/Ascent Phases for AFSS Phase I Simulations 


Phase I simulations were performed on a PC using a JAVA development environment. Although 
a limited subset of flight algorithms and destruct rules were utilized during the simulation, verification of 
the approach was successful and the subsequent phase II, which was contingent upon phase I outcomes, 
was given the go ahead. 

Phase II Development (Historical) 

Phase II efforts were performed by both WFF and KSC Civil Service personnel with direct 
support from their engineering contractors. In addition, Lockheed Martin Space Systems Company 
continued their support from Phase I through a Defense MicroElectronics Activity (DMEA) contract 
managed by WFF. Phase II expanded on the algorithms developed in Phase I and implemented them on a 
Single Board Computer (SBC). The implemented solution for Phase II was a VME Radstone PPC4A-750 


SBC with VxWorks Real Time Operating System (RTOS). The configuration also included two Ashtech 
G12 GPS receivers (see Figure 3). 
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Figure 3. Phase II AFFS Configuration 


Implementation of the software algorithms was continued from Phase I and utilized a Grid 
Structure Mapping Technique for Instantaneous Impact Point/Prediction (IIP) Limit Zones (see Figure 4). 
This approach made Graphical User Interaction (GUI) development minimal and also ensured easier 
readability of the results. However, it also meant more required resources for larger and/or more detailed 
ground areas. 




• Each grid point represents a discrete 
ground track region in nautical miles 
or degrees. 

• Each color represents a different 
AFSS safety region: 

Red = terminate flight if in this region 
Green = amber time countdown initiated 

Blue = nominal region 

Yellow = check dwell time over area 


Figure 4. IIP Limit Zones Grid Structure Mapping Technique 




As an example of the type of GUIs developed in Phase II, see Figure 5. 
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Figure 5. AFSS Phase II Ascent/Liftoff Displays 
Phase II Testing (Historical) 

As part of the Phase II AFSS development, high fidelity testing was performed at the WFF GPS 
Simulation Lab utilizing GPS simulators on a fully integrated lab/bench version AFSS system. The 
primary objective of this testing was to evaluate the AFSS decision logic software. WFF personnel 
developed two baseline missions for testing. The first one was based on an actual Athena launch out of 
Kodiak, Alaska (see Figure 6). The second was a custom designed trajectory, based on a hypothetical 






surplus motor 3-stage to orbit ELV, which was referred to as Wallops Express (see Figure 6. Kodiak 
Star Baseline Mission Figure 7. Wallops Express Baseline Mission). 
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Figure 6. Kodiak Star Baseline Mission Figure 7. Wallops Express Baseline Mission 

WFF personnel then generated 20 test scenarios and associated flight trajectory simulations based 
on these baseline trajectories. These scenarios and trajectories were than played back through a GPS 
simulator at WFF’s GPS Simulation Lab as shown in Figure 8 to test AFSS during Phase II. 



Figure 8. Phase II WFF Simulation Lab Test Configuration 


Although there were several failures of the AFSS system (both Decision Logic and SBC RTOS 
I/O based), the primary test objective of verifying this type of system’s feasibility was met during the 
testing of 28 unique and different scenarios (20 initial and 8 additional). In addition, valuable lessons 
learned were acquired. Significant programmatic and AFSS system changes for Phase III were based on 
these lessons learned. 















































Phase III Development (Current) 

The most significant programmatic change for AFSS Phase III development was the agreement 
between NASA’s KSC and WFF. Both of these Centers have assumed responsibility for AFSS with 
support from existing on-site engineering support contractors. The project also became a 3-year effort to 
produce a flight qualifiable system with extensive testing. The Grid Structure Mapping Technique 
utilized in Phase II was abandoned in place of a vector-mapped technique. Additional navigational 
sensors in the form of a Rockwell Collins GNP-10 GPS/INS Navigational Sensor are being employed in 
Phase HI. A typical GPS/INS configuration and its advantages are shown in Figure 9. Coupling the 
GNP-10 with an Inertial Measurement Unit (IMU) such as a Honeywell HG1700 Laser Ring Gyro or 
Litton LN200 Fiber Optic Gyro results in a synergistic GPS/INS combined system. 



GPS and INS provide dual phenomena redundancy 

• INS measures angular & translational accelerations (vehicle based) 

• GPS measures vehicle position (satellite constellation based) 
lNS,aids.(he,Q PS .track i ng loop 

• Allows receiver to maintain lock through highly dynamic (high acceleration/high 
jerk) environments 

GPS calibrates the INS 

• Corrects for degradation of (vehicle position) data due to the cumulative error of 
integration - Error increases with elapsed time. 


Figure 9. Typical GPS/INS Configuration 


Preliminary system requirements and Concept of Operations (Con-Ops) documents have been 
released and reviewed by various interested range parties. This has resulted in numerous discussions with 
significant insight into the range world by AFSS participants. In particular, the Air Force Range Safety 
community has been very responsive and helpful, always willing to answer questions and to support 
reviews and demonstrations. 

Changes in the algorithmic software approach on AFSS have resulted in four main types of 
missions rules. The four fundamental types of mission rules are: 

1 . The Parameter Threshold Rule allows the user to specify one or more threshold conditions 
that will trigger a destruct condition. It can be used to implement mission rules for erratic 
flight, no pitch program, no stage ignition, and low performance. 

2. The Map Boundary Rule possesses support functions for evaluating whether or not a 
specified set of vehicle coordinates is inside or outside of a simple closed curve described in 
an associated boundary entity. 

3. The Gate Rule possesses support algorithms for evaluating whether or not a specified set of 
vehicle coordinates has advanced beyond a line described in an associated gate entity. 

4. The Green-Time Rule possesses support functions for evaluating whether or not a flight 
containment rule could be violated during a period of time within which the AFSS software 
has received no valid navigation solution data. 

The flexibility of this proposed architecture results from the rich set of system modes and state 
variables made available for various mission rules. Therefore, it is expected that this modest library of 
rule types will accommodate virtually any ELV mission. Successful regression testing of the new 
algorithms with sensors and scenarios/trajectories from Phase II has been successful. 




A change on the hardware side from a VME form factor SBC to a PC 104 form factor SBC ahs 
significantly reduced the footprint and power requirements of an AFSS (currently utilizing MPL MIP405 
PC 104 SBCs). Like any highly reliable system (range requires 0.999 at 95%), redundancy is a key issue 
to a full up AFSS. It is envisioned that AFSS will have multiple navigational sensors that are cross- 
strapped to at least 3 flight processors. Current work is being performed on developing the capability of 
testing a “single string processor” AFSS subset as shown shaded in green in Figure 10 below. The 
Command Switching Logic and Interlock Circuit (CSLIC) interfaces between the flight processors and 
the FTS’s ordnance train. This section provides a means of arming and disarming the FTS safe/arm units 
for both ground and flight operations. 
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Figure 10. Phase HI AFSS Hardware Configuration 


An aircraft flight test is currently planned for the “single string processor” AFSS once formal 
bench lab testing at WFF’s GPS Simulation Lab has been successfully passed. In addition, extensive 
Monte Carlo simulation testing is planned for AFSS. 

Conclusion 

This project is an example of the “One NASA” initiative by providing resources from multiple 
locations to develop new technologies in space flight. Funding is currently provided by NASA 
Headquarters, Office of Space Flight, and Office of Safety and Mission Assurance. Wallops Flight 
Facility is providing project management, systems engineering, sensors, flight algorithms, software 
support, and testing. Kennedy Space Center is providing flight computer and sensor interface, software 
development and process management, flight algorithm support and systems engineering support. 

The switch from a man-in-the-loop to an autonomous FTS is a significant undertaking that 
impacts both public safety and mission success. The current AFSS initiative visualizes that an interim 
period will exists in which AFSS will be interfaced with current systems. To achieve this, the AFSS 
architecture will have the capability of interfacing with one or more traditional Range Safety Command 
Destruct Receivers to enable a human override, or to enable a hybrid mode of operation when desirable. 

2 nd and 3 rd Generation Reusable Launch Vehicle strategies envision order-of-magnitude 
improvements in launch vehicle safety and life cycle costs. A prerequisite for achieving these goals is to 
streamline and simplify the launch range(s) infrastructure. AFSS has the potential for removing all 
dependence on launch range infrastructure for flight safety. The AFSS concept requires none of the RF 
communication and command links, radar stations, data processing, display facilities, and trained 
operators needed by current land-based systems. Instead, it relies on an on-board GPS/INS system for its 
metric data source and on-board logic to emulate human decision processes. 





